What hermetic means

"Hermetic" is the first word in the description of what hiiu produces, and it would be worth very little as an adjective. So it is written down as something a machine can check instead.

The build is reproducible, not hermetic #

hiiu build reaches the network, and it has to. The base is installed with the app's own package manager and its own lockfile, because anything else drifts from the real app at the first hoisting quirk, and an install means a registry.

So the build gets two rules rather than one prohibition:

1. It may reach a package registry, and nothing else. Not the app's own services, not a staging environment, not any host named in its env files.
2. Two builds of one (source revision, config version, generator version) produce byte identical output.

The running copy is hermetic, and that is testable #

With egress from the machine blocked to everything except loopback, every discovered route renders without crashing, and the unmatched request count is zero on priority routes.

Egress blocked is the operative clause. It turns "no external services" from a statement of intent into an experiment: run the crawl with the network off. Anything that was quietly depending on a real host fails there, loudly, in CI, rather than in front of a design partner.

hiiu verify is that crawl. It visits every declared route on a running server and records what each one did, which is why the same command answers both halves of the question: did the pages render, and did anything try to leave.

No real data is a separate claim #

Every value the copy serves comes from the seeded world, which is a pure function of the IR hash and the scenario seed. Nothing else can produce a response body, because default deny is what happens to everything else. That is a stronger guarantee than filtering: there is no path by which a real record could arrive, rather than a rule that is supposed to catch it.

What it costs #

Third party static assets stop being an accident and become an explicit problem. A font from a CDN, an image from a bucket, a stylesheet from another origin: each one is egress, so each one either gets vendored into the base or shows up in the gap list. The list is the point. A copy that silently rendered without its typeface would be worse than one that told you which host it wanted.